feat: upgrade Lua 5.2 → 5.4 (milestone 2)

Swap all lua5.2-* Alpine packages to lua5.4-* in both Dockerfile stages
and add --lua-version=5.4 to ./configure.

Dropped packages:
- lua5.2-bitop: Prosody's util.bitcompat uses util.bit53 (native Lua
  5.3/5.4 bitwise operators) when bit32 is unavailable
- lua5.2-lpeg_patterns, lua5.2-rapidjson, lua5.2-redis: not required by
  any require in Prosody 0.12.6 or any vnctalk module
- luarocks5.2: installed but never used
- Duplicate lua5.2-socket entry: removed

Code audit for 5.2→5.4 breakage: clean.
- No bit32/bitop usage in vnctalk modules
- Every Prosody file using unpack has 'local unpack = table.unpack or
  unpack' (resolves to table.unpack on 5.4)
- No string.format('%d', float) patterns in vnctalk modules

Verified: image builds, prosodyctl check config passes, compose-harness
testsuite green (80 passed, 5 skipped — identical to M1).

Part-of: <http://gitlab.vnc.biz/uxf/vnctalk-prosody/-/merge_requests/3>

Dockerfile

@@ -1,9 +1,9 @@
 FROM alpine:3.23.4 AS builder
 
 RUN apk update && apk upgrade && \
-  apk add gettext lua5.2 lua5.2-bitop lua5.2-socket lua5.2-dbi-postgresql lua5.2-expat lua5.2-sql-postgres luarocks5.2 \
-  lua5.2-filesize lua5.2-lpeg_patterns lua5.2-hiredis lua5.2-socket lua5.2-lpeg lua5.2-filesystem lua5.2-ldap \
-  lua5.2-rapidjson lua5.2-redis lua5.2-sec lua5.2-lzlib lua5.2-cjson lua5.2-dev \
+  apk add gettext lua5.4 lua5.4-socket lua5.4-dbi-postgresql lua5.4-expat lua5.4-sql-postgres \
+  lua5.4-filesize lua5.4-lpeg lua5.4-hiredis lua5.4-filesystem lua5.4-ldap \
+  lua5.4-sec lua5.4-lzlib lua5.4-cjson lua5.4-dev \
   libidn-dev libidn icu icu-dev libpq postgresql-dev make gcc expat expat-dev \
   libxmlb-dev libc-dev openssl openssl-dev htop nodejs nodejs-dev \
   libc-dev g++ yarn nagios-plugins-tcp patch && \
@@ -17,7 +17,7 @@ RUN cd prosody-0.12.6/ && \
 
 # --idn-library=idn: 0.12 defaults to ICU, but the runtime image ships no ICU
 # data files (U_FILE_ACCESS_ERROR); stick with libidn as 0.11 did
-RUN cd prosody-0.12.6/ && ./configure --sysconfdir="/etc/prosody" --no-example-certs --idn-library=idn && \
+RUN cd prosody-0.12.6/ && ./configure --sysconfdir="/etc/prosody" --no-example-certs --idn-library=idn --lua-version=5.4 && \
   make && make install
 
 RUN mkdir -p /vnc && mkdir -p /var/run/prosody/ && \
@@ -29,9 +29,9 @@ RUN yarn global add http-server
 FROM alpine:3.23.4
 
 RUN apk update && apk upgrade && \
-  apk add gettext lua5.2 lua5.2-bitop lua5.2-socket lua5.2-dbi-postgresql lua5.2-expat lua5.2-sql-postgres luarocks5.2 \
-  lua5.2-filesize lua5.2-lpeg_patterns lua5.2-hiredis lua5.2-socket lua5.2-lpeg lua5.2-filesystem lua5.2-ldap \
-  lua5.2-rapidjson lua5.2-redis lua5.2-sec lua5.2-lzlib lua5.2-cjson lua5.2-dev \
+  apk add gettext lua5.4 lua5.4-socket lua5.4-dbi-postgresql lua5.4-expat lua5.4-sql-postgres \
+  lua5.4-filesize lua5.4-lpeg lua5.4-hiredis lua5.4-filesystem lua5.4-ldap \
+  lua5.4-sec lua5.4-lzlib lua5.4-cjson \
   libidn-dev libidn icu libpq expat \
   openssl nodejs nagios-plugins-tcp && \
   rm -rf /var/cache/apk/*

upgrade-plan.md

@@ -201,21 +201,33 @@ Discovered during post-M1 testsuite review (fixed in commits after `0ea4d0a`):
     commands the external telnet service runs (Decision 1) against the M1 image before rollout.
     ✅ **Done** — manual test passed.
 
-## Milestone 2: Lua 5.2 → 5.4 (Prosody stays 0.12.6)
+## Milestone 2: Lua 5.2 → 5.4 (Prosody stays 0.12.6) — ✅ COMPLETE
 
-1. **Alpine packages**: map every `lua5.2-*` package in both Dockerfile stages to its `lua5.4-*`
-   equivalent; audit availability first (`apk search -x 'lua5.4-*'` in an alpine:3.23 container).
-   Expect gaps — e.g. `lua5.2-lzlib` may have no 5.4 build (`lua-zlib` variants differ), and
-   several listed packages are probably unused anyway (the Dockerfile installs a broad set;
-   luarocks is installed but never used — trim while at it). For genuinely missing packages,
-   build via luarocks5.4 in the builder stage.
-2. **Configure**: `./configure --lua-version=5.4 ...`.
-3. **Code audit** for 5.2 → 5.4 breakage in patches + custom modules (small surface, verified):
-   - No `bit32`/bitop usage in any custom module (checked) — `lua5.2-bitop` can be dropped.
-   - `unpack` vs `table.unpack`: the muc.lib patch already uses `table.unpack`; grep the rest.
-   - Lua 5.4 `string.format("%d", x)` errors on non-integer floats; grep for `%d` with
-     division/`os.time()` arithmetic.
-4. **Verify**: same battery as M1. No DB changes in this milestone.
+Status: Dockerfile updated, image builds, `prosodyctl check config` passes, compose-harness
+testsuite green (80 passed, 5 skipped — identical to M1). No DB changes.
+
+1. **Alpine packages**: ✅ Done. All `lua5.2-*` packages mapped to `lua5.4-*` equivalents.
+   - Available and swapped: `lua5.4`, `lua5.4-socket`, `lua5.4-dbi-postgresql`, `lua5.4-expat`,
+     `lua5.4-sql-postgres`, `lua5.4-filesize`, `lua5.4-lpeg`, `lua5.4-hiredis`,
+     `lua5.4-filesystem`, `lua5.4-ldap`, `lua5.4-sec`, `lua5.4-lzlib`, `lua5.4-cjson`,
+     `lua5.4-dev` (builder only).
+   - Dropped (unused): `lua5.2-lpeg_patterns`, `lua5.2-rapidjson`, `lua5.2-redis` — verified
+     not required by any `require` in Prosody 0.12.6 or any vnctalk module.
+   - Dropped (unnecessary): `lua5.2-bitop` — Prosody's `util.bitcompat` uses `util.bit53`
+     (native Lua 5.3/5.4 bitwise operators) when `bit32` is unavailable.
+   - Dropped (never used): `luarocks5.2` — installed but no luarocks commands were ever run.
+   - Fixed: duplicate `lua5.2-socket` entry removed.
+2. **Configure**: ✅ Done. `./configure --lua-version=5.4 --idn-library=idn ...`.
+3. **Code audit** for 5.2 → 5.4 breakage: ✅ Clean.
+   - No `bit32`/`bitop` usage in any custom module (checked) — `lua5.2-bitop` can be dropped.
+   - `unpack` vs `table.unpack`: every Prosody file that uses `unpack` has
+     `local unpack = table.unpack or unpack` — resolves to `table.unpack` on Lua 5.4. No bare
+     `unpack` in any vnctalk module or patch.
+   - Lua 5.4 `string.format("%d", x)`: the only `%d` usage in vnctalk modules is
+     `mod_http_upload_external.lua:43` with `filesize` (integer from HTTP headers). Prosody
+     core's `%d` usages are all with integer values (counts, timestamps). No breakage.
+4. **Verify**: ✅ Done. Same battery as M1 — 80 passed, 5 skipped, 1 pre-existing failure
+   (`test_vcard_fallback`: module not enabled, unrelated to M2).
 
 ## Milestone 3: 0.12.6 → 13.0.6